NSA ANT Raumuberwachung, 30C3, Jacob Appelbaum, 30 December 2013 



Urn in Raume hineinzuhorchen und zu sehen, ohne tatsachlich Funksignale aussendende Wanzen zu 
installieren, hat die NSA-Abteilung ANT eine ganze Reihe von Geratschaften entwickelt. Die meisten basier 
auf einer Kombination von Hardware-Einbauten, die ein sehr unauffalliges Signal erzeugen und einer Radai 
Einheit, die von auBen auf den uberwachten Raum gerichtet wird. Die zuruckgeworfenen Radarwellen werd 
durch das Signal des im Raum versteckten Implantats verandert. Auf diese Weise lasst sich der Ort eines ir 
Raum platzierten Gegenstandes ebenso erfassen (TAWDRYYARD) wie im Raum gesprochene Sprache 
(LOUDAUTO) Oder das auf einem Monitor angezeigte Bild (NIGHTWATCH, RAGEMASTER). Die Familie 
dieser Kombinations-Spahgerate aus Hardware-Implantat und Radarerfassung nennt die Abteilung ANT 
ANGRYNEIGHBOR - zorniger Nachbar. Die Radareinheit CTX4000 dagegen kann Abstrahlungen von Gere 
wie Laserdruckern sichtbar machen, auch wenn die kein Implantat aufweisen. Dieses System nennt die NS> 
DROPMIRE - es wurde internen Dokumenten zufolge beispielsweise gegen die EU-Niederlassung in 
Washington eingesetzt. 

CTX4000 ist ein Sender kontinuierlicher Radarwellen zur Signalanalyse der Reflektionen von Implantaten el 
der ANGRYNEIGHBOR-Familie. Es wird unter anderem zum Datensammein mit einer DROPMIRE genanni 
Methode genutzt- diese kam beispielsweise gegen die EU-Vertretung in Washington zum Einsatz. 

LOUDAUTO ist eine passive Audio-Wanze, die Sprache aufzeichnet und durch Radarwellen -Bestrahlung di 
Daten nach auBen ubermittelt. 

NIGHTWATCH ist ein System zur Rekonstruktion von Monitorsignalen angegriffener Zielsysteme. 

PHOTOANGLO ist ein weiterentwickeltes Radarsystem (Nachfolger des CTX4000), das die Reflexionen 
kontinuierlicher Signale auswertet. Damit lassen sich passive Wanzen wie die der ANGRYNEIGHBOR-Fam 
von Weitem auslesen. 

TAWDRYYARD ist ein Hardware-Modul, das eingehende Radarwellen zuruckwirft und es so moglich machl 
es etwa durch Wande in einem Raum zu lokalisieren. Es wird unter anderem benutzt, urn RAGEMASTER- 
Module, die Monitore uberwachen sollen (siehe unter "Bildschirm"), leichter auffindbarzu machen. 
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CTX4000 

ANT Product Data 



(TS//SI//REL TO USA.FVEY) The CTX4000 is a portable continuous wave (CW) 
radar unit. It can be used to illuminate a target system to recover different off net 
information. Primary uses include VAGRANT and DROPMIRE collection. 
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(TS//SI//REL TO USA.FVEY) The CTX4000 provides the means to collect signals 
that otherwise would not be collectable, or would be extremely difficult to collect 
and process. It provides the following features: 

• Frequency Range: 1 - 2 GHz. 

• Bandwidth: Up to 45 MHz 

• Output Power: User adjustable up to 2 W using the internal amplifier; external 
amplifiers make it possible to go up to 1 kW. 

• Phase adjustment with front panel knob 

• User-selectable high- and low-pass filters. 

• Remote controllable 

• Outputs: 

• Transmit antenna 

• I & Q video outputs 

• DC bias for an external pre-amp on the Receive input connector 

• Inputs: 

• External oscillator 

• Receive antenna 
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Unit Cost: N/A 

Status: unit is operational. However, it is reaching the end of its service life. It is 
scheduled to be replaced by PHOTOANGLO starting in September 2008. 

POC: S32243, ^^^ Bg)nsa.ic.qov 
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Derived From: NSAJCSSM 1-52 
Dated: 20070108 
Declassify On: 20320108 
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LOUDAUTO 

ANT Product Data 



(TS//SI//REL TO USA, FVEY) Audio-based RF retro-reflector. Provides room 
audio from targeted space using radar and basic post-processing. 
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(U) Capabilities 

(TS//SI//REL TO USA, FVEY) LOUDAUTO's 
current design maximizes the gain of the 
microphone. This makes it extremely useful for 
picking up room audio. It can pick up speech at 
a standard, office volume from over 20’ away. 
(NOTE: Concealments may reduce this distance.) 
It uses very little power (-15 uA at 3.0 VDC), so 
little, in fact, that battery self-discharge is more of 
an issue for serviceable lifetime than the power 
draw from this unit. The simplicity of the design 
allows the form factor to be tailored for specific 
operational requirements. All components at 
COTS and so are non-attributable to NSA. 
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(U) Concept of Operation 

TS//SI//REL TO USA,FVEY) Room audio is picked up by the microphone and 
converted into an analog electrical signal. This signal is used to pulse position 
modulate (PPM) a square wave signal running at a pre-set frequency. This 
square wave is used to turn a FET (field effect transistor) on and off. When 
the unit is illuminated with a CW signal from a nearby radar unit, the 
illuminating signal is amplitude-modulated with the PPM square wave. This 
signal is re-radiated, where it is picked up by the radar, then processed to 
recover the room audio. Processing is currently performed by COTS 
equipment with FM demodulation capability (Rohde & Schwarz FSH-series 
portable spectrum analyzers, etc.) LOUDAUTO is part of the 
ANGRYNEIGHBOR family of radar retro-reflectors. 



Unit Cost: $30 

Status: End processing still in development 

S32243. 5nsa.ic.qov 
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NIGHTWATCH 

ANT Product Data 



(TS//SI//REL TO USA, FVEY) NIGHTWATCH is a portable computer with 
specialized, internal hardware designed to process progressive-scan (non- 
interlaced) VAGRANT signals. 



24 Jul 2008 




(U) Capability Summary 
(TS//SI//REL TO USA, FVEY) The current 
implementation of NIGHTWATCH consists of 
a general-purpose PC inside of a shielded 
case. The PC has PCI digitizing and clock 
cards to provide the needed interface and 
accurate clocking required for video 
reconstruction. It also has: 

• horizontal sync, vertical sync and video 
outputs to drive an external, multi-sync 
monitor. 

• video input 

• spectral analysis up to 150 kHz to provide for indications of horizontal and 
vertical sync frequencies 

• frame capture and forwarding 

• PCMCIA cards for program and data storage 

• horizontal sync locking to keep the display set on the NIGHTWATCH display. 

• frame averaging up to 2‘^16 (65536) frames. 

(U) Concept of Operation 

(TS//SI//REL TO USA, FVEY) The video output from an appropriate collection 
system, such as a CTX4000, PHOTOANGLO, or general-purpose receiver, is 
connected to the video input on the NIGHTWATCH system. The user, using the 
appropriate tools either within NIGHTWATCH or externally, determines the 
horizontal and vertical sync frequencies of the targeted monitor. Once the user 
matches the proper frequencies, he activates "Sync Lock" and frame averaging 
to reduce noise and improve readability of the targeted monitor. If warranted, the 
user then forwards the displayed frames over a network to NSAW, where 
analysts can look at them for intelligence purposes. 

Unit Cost: N/A 

Status: This system has reached the end of its service life. All work concerning 
the NIGHTWATCH system is strictly for maintenance purposes. This system is 
slated to be replaced by the VIEWPLATE system. 
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POC: 
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PHOTOANGLO 

ANT Product Data 



(TS//SI//REL TO USA.FVEY) PHOTOANGLO is a joint NSA/GCHQ project to 
develop a new radar system to take the place of the CTX4000. 



(U) Capabilities 

(TS//SI//REL TO USA.FVEY) The planned capabilities for this system are: 
•Frequency range: 1 - 2 GHz, which will be later extended to 1 - 4 GHz. 
•Maximum bandwidth: 450 MHz. 

•Size: Small enough to fit into a slim briefcase. 

•Weight: Less than 10 lbs. 

•Maximum Output Power: 2 W 
•Output: 

•Video 

•Transmit antenna 
•Inputs: 

•External oscillator 
•Receive antenna 



(U) Concept of Operation 

(TS//SI//REL TO USA.FVEY) TS//SI//REL TO USA.FVEY) The radar unit 
generates an un-modulated, continuous wave (CW) signal. The oscillator is 
either generated internally, or externally through a signal generator or cavity 
oscillator. The unit amplifies the signal and sends it out to an RF connector, 
where it is directed to some form of transmission antenna (horn, parabolic dish, 
LPA, spiral). The signal illuminates the target system and is re-radiated. The 
receive antenna picks up the re-radiated signal and directs the signal to the 
receive input. The signal is amplified, filtered, and mixed with the transmit 
antenna. The result is a homodyne receiver in which the RF signal is mixed 
directly to baseband. The baseband video signal is ported to an external BNC 
connector. This connects to a processing system, such as NIGHTWATCH, an 
LFS-2, or VIEWPLATE, to process the signal and provide the intelligence. 



Unit Cost: $40k (planned) 

Status: Development. Planned IOC is 1st QTR FY09. 

S32243. ^^^^B.^^^ ^gnsa.ic.qov 
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TAWDRYYARD 

ANT Product Data 



(TS//SI//REL TO USA, FVEY) Beacon RF retro-reflector. Provides return 
when illuminated with radar to provide rough positional location. 
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(U) Capabilities 

(TS//SI//REL TO USA.FVEY) TAWDRYYARD is 
used as a beacon, typically to assist in locating 
and identifying deployed RAGEMASTER units. 
Current design allows it to be detected and located 
quite easily within a 50' radius of the radar system 
being used to illuminate it. TAWDRYYARD draws 
as 8 pA at 2.5V (20pW) allowing a standard lithium 
coin cell to power it for months or years. The 
simplicity of the design allows the form factor to 
be tailored for specific operational requirements. 
Future capabilities being considered are return of 
GPS coordinates and a unique target identifier and 
automatic processing to scan a target area for 
presence of TAWDRYYARDs. All components are 
COTS and so are non-attributable to NSA. 
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(U) Concept of Operation 

(TS//SI//REL TO USA.FVEY) The board generates a square wave operating 
at a preset frequency. This square wave is used to turn a FET (field effect 
transistor) on and off. When the unit is illuminated with a CW signal, the 
illuminating signal is amplitude-modulated (AM) with the square wave. This 
signal is re-radiated, where it is picked up by the radar, then processed to 
recover the clock signal. Typically, the fundamental is used to indicate the 
unit’s presence, and is simply displayed on a low frequency spectrum 
analyzer. TAWDRYYARD is part of the ANGRYNEIGHBOR family of radar 
retro-reflectors. 



Unit Cost: $30 

Status: End processing still in development 

POC: S32243, ^^^ M@nsa.ic.qov 
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